Method and device for optics based quantum random number generation

ABSTRACT

A device for random number generation based on an optical process of quantum nature, including a light source emitting photons randomly, a light detector adapted to absorb the randomly emitted photons and to measure a number n of photons produced by the light source in a time interval T, and a randomness extractor. The detector includes a photon sensor acting as a photon-to-electron converter, an amplifier for converting the electron signal received from the photon sensor into a voltage and amplifying the voltage signal, as well as an analog-to-digital converter for processing the amplified signal received from the amplifier by encoding the amplified signal into digital values and sending these digital values to the randomness extractor for further processing such as to produce quantum random numbers (QRNs) based on the number of photons produced by the light source in a time interval T.

RELATED APPLICATION

The present application is a continuation of U.S. patent applicationSer. No. 14/697,320, filed Apr. 27, 2015, which claims priority toEuropean Patent Application No. 14166272.6 filed Apr. 28, 2014, thedisclosures of which are hereby incorporated by reference herein intheir entireties.

FIELD OF THE INVENTION

The present invention pertains to a device for quantum random numbergeneration based on an optical process of quantum nature comprising alight source emitting photons randomly as well as to a correspondingmethod, both allowing to obtain random numbers of high quality.

BACKGROUND OF THE INVENTION

In general, the present invention is situated in the context of thegeneration of random numbers. In fact, the generation of high qualityrandom numbers is essential to security of many applications such ascryptographic protocols, both classical and quantum. For example,conventional asymmetric key protocols, like the well known DSA-, RSA-and Diffie-Hellman-algorithms, use random numbers, tested for primality,to generate their keys. Another example is the unconditionally secureone-time pad protocol which needs a string of perfectly random numbersof a length equal to that of the data to be encrypted. The mainlimitation of this protocol is the requirement for key exchange. Quantumkey distribution offers a way to generate two secure keys at distantlocations, but its implementation also requires a vast quantity ofrandom numbers. All these examples reflect Kerckhoffs' principle whichdates back to the 19^(th) century and states that the security of acypher must reside entirely in the key.

It is therefore of particular importance that the key used in acryptographic algorithm is secure, which in practice requires it to bechosen at random. In the past, weaknesses in random number generationhave resulted in the breaking of a number of systems and protocols, suchas reported by Arjen K. Lenstra, James P. Hughes, Maxime Augier, JoppeW. Bos, Thorsten Kleinjung, and Christophe Wachter in their article “Ronwas Wrong, Whit is Right” published in 2012 in the Cryptology ePrintArchive. Such breakings concern many kind of fields like operatingsystem security, see the article “Cryptanalysis of the Random NumberGenerator of the Windows Operating System” by Leo Dorrendorf, ZviGutterman, and Benny Pinkas published in ACM Trans. Inf. Syst. Secur.,13(1):1-32, 2009, communication protocols, see the article“Openssl—Predictable Random Number Generator” by Luciano Bello publishedin Debian security advisory 1571-1, 2008, digital rights management, seethe publication “Ps3 Epic Fail” by Bushing, Marcan, Segher, and Sven atthe 27th Chaos Communication Congress, 2010, and Financial Systems, seethe article “Android Bug Batters Bitcoin Wallets” by Richard Chirgwinpublished in The Register, 2013. Random number generation nowadays thusnot only concerns defense issues such as initially targeted byKerckhoffs' studies but has influence on many other fields like computertechnology and science in general, economy, lotteries and games, as wellas privacy issues of institutional—or individual's personal data storedor encrypted based on protocols using random numbers.

However, high quality random numbers are hard to produce, in particularthey cannot be generated by a deterministic algorithm such as a computerprogram. In fact, existing algorithm-based quasi-random numbergenerators may advantageously be used for simulation purposes, but arenot adapted for cryptography, since the resulting quasi-random numbersare, in principle, reproducible. To ensure the uniqueness and,importantly, the randomness of the generated bit string, a physicalrandom number generator is required, such as explained by C. H. Vincentin the article “The Generation of Truly Random Binary Numbers” inJournal of Physics E: Scientific Instruments, 3(8):594, 1970, or Y.Saitoh, J. Hori, and T. Kiryu in the article “Generation of PhysicalRandom Number Using Frequency Modulated LC Oscillation Circuit with ShotNoise” in Electron Comm. Jpn. 3, 88(5):12-19, 2005.

In the past, two types of physical random number generators have beenproposed which exploit the statistical nature of physical processes.Generators of the first type use processes which in principle obeydeterministic laws but have chaotic nature due to complexity andincomplete knowledge of the initial system state. As an example, imagesensors have been used to generate random numbers of classical origin byextracting information from a moving scene, e.g., a lava lamp, or usingsensor readout noise, like disclosed by R. G. Mende, L. C. Noll, and S.Sisodiya in U.S. Pat. No. 5,732,138 entitled “Method for Seeding aPseudo-Random Number Generator with a Cryptographic Hash of aDigitization of a Chaotic System”, 1998. Other examples for such kind ofphysical random number generators are disclosed in U.S. Pat. No.6,831,980, U.S. Pat. No. 6,215,874, WO2013/003943, EP 1 821 196,WO01/95091. However, the performance both in terms of randomness andthroughput of such devices, respectively of corresponding methods, hasbeen low.

Generators of the second type use physical processes which feature someintrinsic fundamental randomness, such as quantum mechanical processes.For this reason, quantum random number generators (QRNGs), which bytheir nature produce a string which cannot be predicted, even if anattacker has complete information on the device, are of particularinterest, like explained in more detail in the article “QuantumRandom-Number Generation and Key Sharing” by J. G. Rarity, P. C. M.Owens, and P. R. Tapster, published in Journal of Modern Optic,41(12):2435-2444, 1994. Known QRNGs are based on specialized hardware,such as single photon sources and detectors like disclosed, for example,by A. Stefanov, N. Gisin, O. Guinnard, L. Guinnard, and H. Zbinden intheir article “Optical Quantum Random Number Generator” published inJournal of Modern Optic, 47(4):595-598, 2000, photon pair sources incombination with beam splitters such as disclosed by Wolfgang Dultz andEric Hildebrandt in their U.S. Pat. No. 6,393,448 entitled “OpticalRandom-Number Generator Based on Single-Photon Statistics at the OpticalBeam Splitter”, 2002, or the device proposed by W. Wei and H. Guo in thearticle “Bias-Free True Random-Number Generator” published in Opt.Letters, 34(12):1876-1878, 2009, or homodyne detection like disclosedfor example by Christian Gabriel, Christoffer Wittmann, Denis Sych,Ruifang Dong, Wolfgang Mauerer, Ulrik L. Andersen, Christoph Marquardt,and Gerd Leuchs in their article “A Generator for Unique Quantum RandomNumbers Based on Vacuum States” published in Nat. Photon, 4(10):711-715,2010. Other examples for such kind of physical random number generatorsare disclosed in U.S. Pat. No. 7,284,024, US 2012/045053, JP2009/070009, EP 2 592 547, GB 2 473 078, and WO02/091147. These QRNGs,however, have significant drawbacks, in particular in terms of size andcomplexity due to the required specialized hardware as well as in termsof speed and scalability, which entails high production cost,respectively limited applicability.

The solutions according to prior art therefore inherently compriseseveral problems. If known QRNGs indeed produce random numbers ofquantum, i.e., random origin, the corresponding devices are complex andcost intensive. Devices which generate random numbers of classicalorigin have a low performance in terms of randomness and throughput.

SUMMARY OF THE INVENTION

It is an object of the present invention to overcome the above-mentioneddifficulties and to realize a device for quantum random numbergeneration as well as a corresponding method. The device should havereduced size, complexity, and production cost as well as increased scopeof applicability as compared to existing devices.

To this effect, the present invention proposes a device which ischaracterized, in an embodiment, by the features enumerated in claim 1and which allows to achieve the objectives identified above, as well asa corresponding method.

In an embodiment, the device for random number generation based on anoptical process of quantum nature according to the present inventiondistinguishes by the fact that it further comprises a light detectoradapted to absorb the randomly emitted photons and to measure a number nof photons produced by said light source in a time interval T, and arandomness extractor, wherein the detector comprises a photon sensoracting as a photon-to-electron converter, an amplifier for convertingthe electron signal received from the photon sensor into a voltage andamplifying the voltage signal V, as well as an analog-to-digitalconverter for treating the amplified signal V received from theamplifier by encoding the amplified signal V into digital values d andsending these digital values d to the randomness extractor for furtherprocessing such as to produce quantum random numbers (QRNs) based onsaid number n of photons produced by the light source in a time intervalT.

According to embodiments of this device, the light source may be chosenas a light emitting diode or a laser diode and the photon sensor may beformed by a CCD camera or a CMOS camera. The camera, respectively ingeneral the photon sensor, is operated in the linear regime where itsFano factor is close to 1, and—for optimal performance—theanalog-to-digital converter is tuned such as to have anelectron-to-digital conversion factor fulfilling the condition ζ≧1.

These and other operating parameters of the camera, of the processingelectronics, and of the randomness extractor which are specified in moredetail in the following description allow to realize a small size andlow cost quantum random number generator which produces high qualityrandom numbers of quantum origin and which may be integrated in numberof stationary or mobile apparatuses and instruments.

The invention is also related to a corresponding method and computerprogram means adapted to implement this method.

Other features and advantages of the present invention are mentioned inthe dependent claims as well as in the description disclosing in thefollowing, with reference to the figures, the invention in more detail.

BRIEF DESCRIPTION OF THE FIGURES

The attached figures exemplarily and schematically illustrate theprinciples as well as several embodiments of the present invention.

FIG. 1 schematically illustrates the distribution of probability P(n)that a number n of photons is measured by an image sensor's pixel, saidprobability being the combination of quantum uncertainty σ_(q)originating from the quantum nature of a light source and technicalnoise σ_(t) originating from the technical equipment used.

FIG. 2 schematically illustrates the principal components of a devicefor random number generation according to an embodiment of the presentinvention, these components being a light source, a detector, and arandomness extractor, wherein the detector comprises severalsub-elements, as well as the operating principle of the device.

FIG. 3 shows in schematical manner an example of a device for randomnumber generation according to an embodiment of the present invention,the device comprising an LED as a light source, a detector illuminatedby said LED, and a randomness extractor which treats the digital outputof the detector.

FIGS. 4a and 4b show, for an ATIK 383L camera, respectively for thecamera included in the Nokia N9 mobile telephone, the Fano factor F forvarious illuminating intensities.

FIGS. 5a and 5b show normalized histograms of the photon distributionsobtained when using an ATIK 383L CCD camera and a Nokia N9 CMOS camera,respectively, as a detector.

DETAILED DESCRIPTION OF THE INVENTION

In the following, the invention shall be described in detail withreference to the above mentioned figures.

In a first part, the concept of the proposed system, including itsvarious entropy sources and how the entropy of quantum origin can beextracted, shall be described. In a second part, two differentembodiments of the proposed random number generation shall be exposed.Finally, the results obtained with the help of these random numbergenerators in terms of generated random numbers shall be presented,including tests performed on the generated random numbers.

The concept of the present invention relies on the fact that someproperties of a quantum state are unknown before measurement as well asfundamentally unpredictable. One such property, used in most knownQRNGs, is the path taken by a photon impinging on a beamsplitter.Another such property is the number of photons produced by a lightsource in a time interval T. It is the latter effect which is used inthe context of this invention. In fact, most light sources emit photonsat random times or emit a random number of photons at a time. For easeof the language, both of these effects shall in the further course ofthe description be embraced by the wording that such light sources emitphotons randomly. In any case, it is impossible to predict the number ofphotons emitted per unit time. This quantum effect is usually called“quantum noise” or “shot noise” and has been shown to be a property ofthe light field rather than a technical limitation of the light sourceor of the detector, see e.g., the article “Experimental Realization ofSub-Shot Noise Quantum Imaging” by G. Brida, M. Genovese, and I. R.Berchera published in Nat. Photon, 4(4):227-230, 2010. Only someparticular light sources, namely amplitude-squeezed light, can overcomethis fundamental noise, such as reported by Daniel F. Walls in thearticle “Squeezed States of Light” published in Nature, 306:141-146,1983. Beside these very specific sources, the number of photons emittedby a light source per unit of time T is governed by a Poissondistribution with standard deviation σ=√{square root over (n)}, where nis the mean number of photons emitted in time interval T. Therefore,this quantum effect may be exploited to realise a QRNG by using adetector capable of resolving this distribution, such as to generaterandom numbers originating from a fundamentallly random physicalprocess. Such as schematically illustrated in FIG. 1, the basicassumptions of this approach consist in that (a) a number n ofphotoelectrons can be measured by a detector, e.g., an image sensor'spixel, with a probability P(n), (b) this measured distribution will be,assuming that the detector is operating in a linear regime, thecombination of quantum uncertainty σ_(q) and technical noise σ_(t), and(c) from a single shot measurement these two noise components cannot bedistinguished, however the technical noise σ_(t) is assumed to be fullydeterministic and thus known to an adversary. As will become clear inthe following, it is preferable, but not necessary, for realization of aQRNG according to the present invention that the inevitable technicalnoise σ_(t) of the detector is smaller, or comparable to, the quantumuncertainty σ_(q) originating from the quantum nature of the lightsource.

A device adapted to realize the above concept comprises, such as shownschematically in FIG. 2, a light source 1, a detector 2, and arandomness extractor 3. The light source 1 may be chosen amongst a lightemitting diode (LED), a laser diode (LD), or any other adequate lightsource, even ambient light, as long as the source emits photons randomlyin the meaning defined above. The detector 2 comprises several elementsand can be modelled, such as also schematically indicated in FIG. 2, aslossy channel 2.1 with a transmission probability η, similar to abeamsplitter with a given splitting ratio, followed by a photon sensor2.2 acting as a photon-to-electron converter with unit efficiency. Inthis model, the transmission probability η contains all the losses dueto the optical elements and the photon sensor's 2.2 quantum efficiency.The photon sensor 2.2 may be realized by any kind of photon detector, inparticular by an image sensor with an array of pixels or even by eachindividual pixel of such an image sensor, like a nowadays commerciallyavailable CCD or CMOS camera or similar off-the-shelf components adaptedto act as an image sensor and having sufficient light sensitivity. Asmall quantity of light from the light source 1 impinges on the photonsensor 2.2. This can be done by guiding, reflecting or scattering at thedye, package or assembly level. For each absorbed photon γ, the photonsensor 2.2 generates an electron e⁻, such as symbolically indicated inFIG. 2. The detector 2 further comprises processing electronics, inparticular an amplifier 2.3 for converting the electron signal receivedfrom the photon sensor 2.2 into a voltage and amplifying the voltagesignal V as well as an analog-to-digital converter (ADC) 2.4 whichtreats the amplified signal V received from the amplifier 2.3 byencoding the amplified signal V representing photon, respectivelyelectron numbers into digital values and sending these values to furtherprocessing, i.e., to said randomness extractor 3 which will be describedin more detail hereafter. The amplifier 2.3 and the ADC 2.4 may also bechosen amongst commercially available elements. All the above mentionedcomponents may be integrated at a circuit, package or dye level.Advantageously, the randomness extractor can be implemented in software,but is also possible to realize that component by hardware. Furthermore,in the context of the processing electronics, it is possible to definean electron-to-digital conversion factor ζ. If ζ≧1, then for eachpossible number of electrons generated by the photon sensor 2.2, i.e.,for each possible number of photons produced by the light source 1 andabsorbed by the sensor 2.2, there is one unique digital value or code atthe output of the ADC 2.4, i.e., at the output of the detector 2. Thecondition ζ≧1 is thus not an obligatory requirement, but preferred foroptimal performance of the device. To complete the model of thedetector, noise needs to be added, since noise of different originslike, e.g., thermal noise, leakage current, or readout noise cannot beavoided in a real device. In general, this noise follows a normaldistribution and adds linearly to the signal, like symbolicallyindicated in FIG. 1.

Consequently, a device such as described above allows to access the shotnoise statistics of the light source 1 and thus to generate randomnumbers of quantum origin. In fact, each photon absorbed by the photonsensor 2.2 will generate an electron, in particular within acorresponding pixel if an image sensor with an array of pixels is used.The number of electrons generated in time interval T is unpredictable,due to the quantum nature of light and of the absorption process. Thenumber of electrons is converted to a voltage, amplified and digitizedby components internal or external to the sensor 2.2. It is importantthat the amount of light and the parameters for the amplification anddigitization are appropriate, so that a significant amount of quantumentropy is collected. Not all the entropy generated by this process hasa quantum origin, because some is due to classical noise, such aselectrical, thermal, amplification, digitization noise or structuregiven by the image itself. However, an appropriately tuned randomnessextractor 3 allows to ensure that the output random numbers have aquantum origin, i.e., that the amount of quantum entropy per output bitis close to 1, such as will become clear in the further course of thedescription which will also specify in more detail the required amountof light and said parameters for the amplification and digitization.

In fact, at the output of the detector 2, a random variableX=X_(q)+X_(t), where X_(q) and X_(t) are independent random variablestaken from the quantum uncertainty distribution D_(q) and the technicalnoise distribution D_(t), respectively, is obtained. The technical noiseis assumed to be completely known to an adversary, called “Eve” in FIG.1, such that it is only possible to rely upon the quantum entropygenerated. Thus, the amount of quantum entropy at the output of thedetector 2 will correspond to the entropy of a Poisson distribution witha mean equal to the average number of photons absorbed n,which—expressed in bits—is

H(X _(q))= n /ln(2)[1−ln( n )]+e ^(−n) /ln(2)Σn ^(−m) ln(m!)/m!  (1).

For large values of n this expression can be approximated to

H(X _(q))=ln(2πen )/(2 ln(2))  (2)

To collect this entropy entirely, the detector preferably should fulfilthe condition ζ≧1 mentioned above. The measured value X can be encodedover b bits, but it is of course possible to encode the value on anotherbasis than the binary system. The entropy H(X_(q)) of quantum origin perbit of the output will be on average H(X_(q))/b<1. Assuming adequatelychosen operating conditions such as mentioned here above, where the ADC2.4 is not saturated, the entropy s per bit can be approximated bydividing H(X_(q)) by the number of output bits of the ADC. To obtain astring of perfectly random bits, i.e., with unit quantum entropy perbit, an extractor is required. As detailed in the article “A RandomnessExtractor for the Quantis Device” by M. Troyer and R. Renner, publishedin Id Quantique Technical Report, 2012, and the content of which isincorporated herein by reference, an extractor computes a number k ofhigh-entropy output bits y_(j) from a number l>k of lower-entropy inputbits r_(i). This can be done by performing a vector-matrixmultiplication between the vector formed by the raw bit values r_(i) anda random l×k matrix M (performed modulo 2) according to

y _(j) =ΣM _(ij) r _(i)  (3).

Although the elements of M are randomly distributed, the matrix Mserving as randomness extractor 3 usually is a pre-generated constant.For raw input bits with entropy s per bit, the probability that theoutput vector y_(j) deviates from a perfectly random bit string isbounded by

ε=2^(−(sl−k)/)2  (4).

Alternatively, an adequate randomness extractor 3 may also be realizedby a hash function performing an operation equivalent to the abovedescribed matrix-multiplication extractor. This is known to the personskilled in the art and thus doesn't need to be further described at thisplace.

In order to demonstrate the feasibility of a device such as describedabove, comprising a light source 1, a detector 2, and a randomnessextractor 3 of the type just described, as well as the results which maybe obtained with a such device, two different embodiments of theproposed random number generator shall now be exposed. In fact, inrecent years, image sensors like the ones found in digital cameras andsmartphones have improved enormously. Their readout noise nowadays is ofthe order of a few electrons and their quantum efficiencies can achieve80%. Besides their ability to resolve quantum noise with high accuracy,such image sensors are intrinsically parallel and offer high data rates.It is thus possible to use such image sensors as a component of aquantum random number generator according to the present invention,which shall in the following be demonstrated both with a commercialastronomy monochrome CCD camera, an ATIK 383L camera, and a CMOS sensorin a mobile phone, a Nokia N9 camera. The latter is a color camera fromwhich only the green pixels were used for the purpose of the followingdemonstration.

FIG. 3 shows in schematical manner an example of a device for randomnumber generation according to an embodiment of the present invention,the device comprising a light source 1 which is realized by a LED, acamera 2 which is fully and homogeneously illuminated by said LED andthe raw data of which, i.e., the binary representation of pixel valuesproduced by the camera 2, are concatenated and passed through arandomness extractor 3 which in turn outputs quantum random numbers(QRNs) ready to be used. The camera 2 is supposed to be formed either bysaid ATIK 383L camera or said Nokia N9 camera.

At first place, it shall be checked that the above mentioned camerascomply with the manufacturer's specification and that the operatingconditions are appropriate for the generation of quantum random numbers.With respect to the latter point, it is important that the photon numberdistribution does not exceed the region where the camera, respectivelythe photon detector realized therewith, is linear and that there areenough digital codes to represent each possible number of absorbedphotons, i.e., that the condition ζ≧1 already mentioned above isfulfilled.

To characterize the two cameras mentioned above, a well-controlled lightsource like a LED, such as schematically shown in FIG. 3, is used.According to the principles shown in FIG. 2, a number of photons n isabsorbed by the photon sensor 2.2 of each camera 2 and converted into anequal number of electrons. This charge is in turn converted into avoltage by the amplifier 2.3 and finally digitized by the ADC 2.4. Forease of description, these components are supposed to form part of thecamera 2 in FIG. 3. The amplifier gain, which in commercially availablecameras corresponds to the “ISO” setting, is chosen such that eachadditional input electron will result in an output voltage increasesufficient to be resolved by the ADC, which means that each electronincreases the digital output code c by at least 1. This can be checkedby illuminating the cameras with a known amount of light. By doing soand using the nominal quantum efficiency of the cameras to infer n, oneobserves ζ=c/e to be 2.3 codes/electron for the ATIK camera, and 1.9codes/electron for the Nokia camera, as expected from the devices'specifications.

The value ζ of can then be used to infer the number n of absorbedphotons from the digital reading. This allows to evaluate the Fanofactor F, defined as F=σ²(n)/n, which is expected to be 1 for a Poissondistribution. Conversely, the fact that for a linear detector the Fanofactor F=1 can be used to measure Q_(e) and ζ. FIGS. 4a and 4b show, forthe ATIK camera, respectively for the Nokia camera, the Fano factor Fobtained in this way for various illuminating intensities of thesedetectors. Accordingly, both detectors have a large range of intensitieswhere the Fano factor is close to 1, in particular both the ATIK and theNokia cameras have good linearity, i.e., better than 0.998 for a largerange of light intensities. In this range, the statistics are dominatedby the quantum uncertainty, i.e., by the shot noise. At strongilluminations, saturation occurs, which means that the Fano factordecreases, as the output is a constant. For the Nokia N9 camera, thishappens at intensities corresponding to about 450 to 500 absorbedphotons per pixel, whilst for the ATIK camera this happens at about2×10⁴ absorbed photons per pixel. This is due to the high amplifier gainused, which was chosen at ISO 3200. At low illumination intensities, aFano factor much greater than 1 is observed, which is due to thedetector's technical noise.

Image sensors such as CCD and CMOS have various sources of noise, likethermal noise, leakage current and readout noise. Thermal and leakagenoise accumulate with integration time, such that it is possible toeliminate or at least greatly reduce these noise sources by using shortexposure times, e.g., exposure times of the order of a millisecond,e.g., in the range of 0.1 to 100 milliseconds. In this case, readoutnoise becomes the dominant source of technical noise and is given by thereadout circuit, the amplifier and the ADC. In image sensors, noise isusually counted in electrons (e⁻). The ATIK 383L CCD camera and theNokia N9 CMOS camera have a noise of 10 e⁻, and 3.3 e⁻, respectively.However, it is not possible to generalize the values of the exposuretimes indicated above for all types of cameras, since this also dependson the impinging light intensity. In fact, the exposure time has to bechosen depending on the type of camera, i.e., the type of detector 2,and the light intensity such that the detector works in its linearregime and that, preferably, the readout noise becomes the dominantsource of technical noise. In practice, the exposure times thus may varygreatly.

In view of the working principles of a QRNG according to the presentinvention mentioned above, in order to allow using these cameras togenerate random numbers of quantum origin, the cameras need to beilluminated such that the mean number of absorbed photons n issufficient to give a quantum uncertainty σ_(q)=√{square root over (n)}as large as possible whilst not saturating the detectors. Therefore, inpractice, the ATIK and Nokia cameras used here to demonstratefeasibility of a device for quantum random number generation accordingto the present invention are illuminated during a time interval Tsufficient to generate 1,5×10⁴ e⁻ and 410 e⁻, respectively. Thespecifications and operating parameters mentioned here above aresummarized in Table 1. Normalized histograms of the obtained photondistributions are shown in FIGS. 5a and 5b for the ATIK 383L CCD cameraand for the Nokia N9 CMOS camera, respectively.

TABLE 1 Specifications of and Operating Parameters Employed for the TwoCameras ATIK 383L Nokia N9 Noise σ_(t) (e⁻) 10 3.3 Saturation (e⁻)   2 ×10⁴ 450-500 Illumination (e⁻) 1.5 × 10⁴ 410 Quantum uncertainty σ_(q)(e⁻) 122 20 Offset (e⁻) 144 −6 Output bits per pixel 16 10 Quantumentropy per pixel 8.9 bits 6.4 bits Quantum entropy per raw bit 0.560.64

At second place, it is then possible on the basis of these facts andoperating parameters to use equation (2) to calculate the amount ofentropy of quantum origin per pixel, which is 8.9 bits and 6.4 bits forthe ATIK 383L CCD camera and for the Nokia N9 CMOS camera, respectively.These are encoded over 16 and 10 bits, respectively, resulting in anaverage entropy per output bit of 0.56 for the ATIK 383L CCD camera and0.64 for the Nokia N9 CMOS camera. These results are also figuring inTable 1. Finally, an adequate extractor 3 is applied according toequation (3) which allows to apply a mixing of the randomness of quantumorigin contained in each raw bit obtained from the detector 2 into theoutput bits of the randomness extractor 3 forming the final digitaloutput of the QRNG as well as to increase the entropy in the output bitsof the randomness extractor 3 as compared to the one in the raw bitsobtained from the detector 2. This is an important reason why it ispreferable, but not necessary for realization of a QRNG according to thepresent invention that the inevitable technical noise σ_(t) of thedetector 2 is smaller, or comparable to, the quantum uncertainty σ_(q).The choice of the extractor 3, in particular with respect to itsdimension k, is done according to the above mentioned principles. Infact, as mentioned above, the detected photon number distribution can bedescribed by a Poisson distribution and its minimum entropy can beapproximated by equation (1). Thus, the size and the compression factorof the extractor 3 may be tuned such as to ensure that each bit ofoutput from the extractor has an amount of quantum entropy close to 1 bydetermining the size and the compression factor of the randomnessextractor so that the number of output bits per measurement is smallerthan the minimal entropy of the detected photon number distribution. Inthe particular case of the matrix-multiplication extractor introducedabove, this can be done using equation (4) and ensuring that theextractor's parameters l and k, for a mean entropy s per bit, are chosensuch as to ensure that the probability ε that the extractor's output bitstring deviates from a perfectly random one is small. In particular,equation (4) above allows to calculate that by using the camera in theNokia cell phone and an extractor with a compression factor of 4, forexample, with k=500 and l=2000, it would take ˜10¹¹⁸ trials to notice adeviation from a perfectly random bit string. Thus, if everybody onearth used such a device constantly at 1 Gbps, it would take ˜10⁸⁰ timesthe age of the universe for one to notice a deviation from a perfectlyrandom bit string.

In order to test the quality of random numbers generated in such manner,48 frames corresponding to approximately 5 Gbits of raw random numbersgenerated using the above described framework were collected andprocessed on a computer through an extractor with a 2000 bit inputvector and a 500 bit output vector, which allowed to generate 1.25 Gbitsof random numbers. Although random number generators are notoriouslyhard to test, it is possible to check the generated bit string forspecific weaknesses. A first testing step may be to individuatepotential problems of the system and then test for them. In the presentcase, the generated random bit string was tested before extraction. Atthis stage, the entropy per bit is still considerably less than unity;moreover, possible errors could arise from damaged or dead pixels of thedetector 2 and from correlations between pixel values due to electricalnoise. In fact, besides increasing the mean entropy per bit, therandomness extractor 3 also ensures that if some pixels become damaged,covered by dust, or suffer from any other problem, an extremely goodquality of the randomness is maintained. A second testing step mayconsist in the “die harder” randomness tests which can be applied onboth the extracted bit strings, i.e., the raw random numbers produced atthe output of the detector 2 and the random numbers delivered by therandomness extractor 3. This set of tests contains the NIST test, thediehard tests and some extra tests. The QRNG according to the presentinvention passed all these tests.

Next to the quality of the random numbers generated, other parameters ofa QRNG are important, e.g., the production speed of the random numbers,as well as affordability and portability of the device. In fact, formany applications, such as the generation of cryptographic keys forconventional use or gaming, speed is not as important as theaffordability and portability which are provided by this system.Nevertheless, a quantum random number generator based on an image sensorcan provide very reasonable performance in terms of speed. Consumergrade devices such as the CCD and CMOS detectors used acquire data atrates between 100 Megapixels per second and 1 Gigapixel per second.After the necessary processing, each pixel will typically provide 3random bits so that rates between 300 Mbps and 3 Gbps can be obtained.To sustain such high data rates, processing can be done either on aField Programmable Gate Array (FPGA) or could be embedded directly on aCMOS sensor chip, including the processing step realized by therandomness extractor 3 which in that case is featured by hardware.Alternatively, implementing the randomness extractor 3 fully in thesoftware of a consumer device is possible and can sustain random bitrates greater than 1 Mbps, largely sufficient for most consumerapplications. Therefore, it is possible to realize a device for quantumrandom number generation according to the present invention by usingtechnology compatible with consumer and portable electronics.

Thus, random numbers of a quantum origin can be extracted byilluminating a known image sensor and applying specific operatingparameters to the photon sensor 2.2, the processing electronics, as wellas the randomness extractor 3. In fact, according to the above figuringexplanations with respect to a device for random number generation basedon an optical process of quantum nature, a corresponding method forrandom number generation comprises the steps of providing a light source1 emitting photons randomly, providing a light detector 2 adapted toabsorb the randomly emitted photons and to measure the number n ofphotons produced by said light source 1 in a time interval T andcomprising a photon sensor 2.2, an amplifier 2.3, and ananalog-to-digital converter 2.4, and providing a randomness extractor 3,such as to allow detecting the number n of photons produced by saidlight source 1 in a time interval T and converting said number ofphotons into a corresponding number of electrons with the help of saidphoton sensor 2.2 of detector 2, converting the electron signal receivedfrom the photon sensor 2.2 into a voltage and amplifying the voltagesignal V with the help of said amplifier 2.3 of detector 2, and treatingthe amplified signal V received from the amplifier 2.3 by encoding theamplified signal V into digital values with the help of saidanalog-to-digital converter 2.4 of detector 2 and sending these valuesto the randomness extractor 3 for further processing such as to producequantum random numbers (QRNs) based on said number n of photons producedby the light source 1 in a time interval T.

The photon sensor 2.2 of detector 2 is illuminated by the light source 1during a time interval T which is chosen such that the mean number ofabsorbed photons n is sufficient to give a quantum uncertaintyσ_(q)=√{square root over (n)} as large as possible whilst not saturatingthe photon sensor 2.2. In particular, the photon sensor 2.2 of detector2 is illuminated by the light source 1 with a photon intensity situatedwithin a range of intensities where the Fano factor of the photon sensor2.2 is close to 1. It is also possible to control the mean number ofabsorbed photons by adjusting the exposure time of the camera, withinthe limit that the exposure time needs to be chosen such that the cameraworks in its linear regime.

Advantageously, the raw digital values r_(i) generated at the ouput ofdetector 2, respectively the digital values y_(j) at the output of therandomness extractor 3 are encoded over b bits, or are encoded onanother basis than the binary system.

Finally, it is to be noted that the present invention is also related tocomputer program means stored in a computer readable medium adapted toimplement the above described method.

In light of the above description of the device and of the correspondingmethod according to the present invention, its advantages are clear.Most importantly, a device for quantum random number generationaccording to the present invention allows generation of high qualityrandom numbers of quantum origin since being based on a fundamentallyrandom physical process. The random numbers may be generated at a highrate. The device can be implemented with commercially-available imagingdevices such as CMOS and CCD cameras which are small and low cost. Also,it can be easily integrated on a printed circuit board. In fact, allelements such as light source, light detector, and randomness extractor,as well as other, optional components like for self-testing and furtherdata processing such as encryption and transmission can be integrated atthe system, circuit, package or dye level, which improves size, ease ofuse, security, reliability and energy efficiency of the whole device.Furthermore, many mobile and computing devices nowadays include an imagesensor of a type adapted to be used, either by minor modification or insome cases directly, as a detector such as required in a deviceaccording to the present invention to generate quantum random numbers.Such image sensors have a low-power consumption compatible with mobileand battery powered applications. The randomness extractor can beimplemented in hardware or, by software. Due to its small size, thedevice can be integrated with other components such as a camera,encryption, transmission, diagnostic device etc.; in particular, giventhat many consumer electronics articles are anyway equipped with animage sensor adapted to be used for the purposes of the presentinvention, the latter may advantageously be integrated with suchcomponents and corresponding software into a computer, a telephone, inparticular mobile computers or telephones, tablets, networkcryptographic devices, personal cryptographic devices, electronicwallets, or any other type of similar instruments. Thus, in general, thesimplicity and performance of a device according to the presentinvention allows, in contrast to existing QRNG, to make widespread useof physical quantum random number generators, with an important impacton information security.

1. Device for random number generation based on an optical process ofquantum nature comprising: a light source emitting photons randomly, alight detector comprising a photon sensor adapted to absorb the randomlyemitted photons, an amplifier for converting an electron signal receivedfrom the photon sensor into a voltage and amplifying the voltage signal,and an analog-to-digital converter (ADC) for treating the amplifiedsignal received from the amplifier by encoding the amplified signal intodigital values and sending these digital values to a randomnessextractor of the device for further processing, wherein the randomnessextractor is adapted to generate a number k of high-entropy output bitsy_(j) from a number l>k of lower-entropy raw input bits r_(i)corresponding to said digital values received from the analog-to-digitalconverter (ADC), the photon sensor of the light detector is adapted tooperate in a linear regime and acts as a photon-to-electron converter toallow the light detector to be adapted to measure a number n of photonsproduced by said light source in a time interval T, such as to producequantum random numbers (QRNs) based on said number n of photons producedby the light source in the time interval T.
 2. The device according toclaim 1, wherein the light source is selected from a group of lightsources consisting of a light-emitting diode (LED), a laser diode (LD),ambient light, or any other adequate light source emitting photonsrandomly.
 3. The device according to claim 1, wherein the photon sensoris selected from a group of photon detectors consisting of a CCD camera,a CMOS camera, in particular an image sensor with an array of pixels, orany other adequate photon detector having a sufficient single photonresolution.
 4. The device according to claim 1, wherein theanalog-to-digital converter has an electron-to-digital conversion factorζ fulfilling the condition ζ≧1.
 5. The device according to claim 1,wherein the randomness extractor is implemented by software or byhardware.
 6. The device according to claim 1, wherein the randomnessextractor is realized by a hash function or by a vector-matrixmultiplication between a vector formed by the raw bit values r_(i)generated at the output of the light detector and a random l×k matrix Maccording toy _(j) =ΣM _(ji) r _(i), where the matrix M serving as the randomnessextractor is a pre-generated constant having randomly-distributed matrixelements, a vector formed by the bit values y_(j) is a digital output ofthe randomness extractor, and i ranges from 1 to l and j ranges from 1to k.
 7. The device according to claim 1, wherein the randomnessextractor is determined such as to produce digital output bit valuesy_(j) of the randomness extractor having an amount of quantum entropyper output bit close to
 1. 8. The device according to claim 1, whereinthe light source, light detector, amplifier, and ADC are integrated at asystem, circuit, package or dye level, preferably on a FieldProgrammable Gate Array (FPGA) or directly on a CMOS sensor chip.
 9. Anapparatus, in particular a computer, a telephone, a mobile computer ormobile telephone, a tablet computer, a smart phone, a networkcryptographic device, a personal cryptographic device, an electronicwallet, or any other type of similar instruments, comprising the deviceof claim
 1. 10. A method for random number generation based on anoptical process of quantum nature comprising the steps of: providing alight source emitting photons randomly, providing a light detectorcomprising a photon sensor adapted to absorb the randomly emittedphotons, an amplifier, and an analog-to-digital converter, converting anelectron signal received from the photon sensor into a voltage andamplifying the voltage signal using said amplifier of the lightdetector, treating the amplified signal received from the amplifier byencoding the amplified signal into digital values using saidanalog-to-digital converter of the light detector and sending thesevalues to a randomness extractor for further processing, and providing arandomness extractor being adapted to generate a number k ofhigh-entropy output bits y_(j) from a number l>k of lower-entropy rawinput bits r_(i) corresponding to said digital values received from theanalog-to-digital converter, operating the photon sensor of the lightdetector in a linear regime such as to allow detecting a number n ofphotons produced by said light source in a time interval T andconverting said number of photons into a corresponding number ofelectrons with the help of said photon sensor of the light detector,such as to produce quantum random numbers (QRNs) based on said number nof photons produced by the light source in a time interval T.
 11. Themethod according to claim 10, wherein the photon sensor of the lightdetector is illuminated by the light source during the time interval T,wherein a mean number of absorbed photons n is sufficient to give aquantum uncertainty σ_(q)=√{square root over (n)} as large as possiblewithout saturating the photon sensor.
 12. The method according to claim10, wherein the photon sensor of the light detector is illuminated bythe light source with a photon intensity situated within a range ofintensities where the Fano factor of the photon sensor is close to 1.13. The method according to claim 10, wherein an exposure time duringwhich the photon sensor is illuminated by the light source is selectedsuch that the light detector works in its linear regime.
 14. The methodaccording to claim 10, wherein the raw input bits r_(i) generated by theanalog-to-digital converter at an output of the light detector,respectively the output bits y_(j) at the output of the randomnessextractor are encoded over b bits, or are encoded on another basis thanthe binary system.
 15. A computer program product stored in anon-transitory computer readable storage medium, the computer programproduct being executable by a processor to implement, in combinationwith the light source emitting photons randomly, a light detectorcomprising a photon sensor adapted to absorb the randomly emittedphotons, an amplifier, an analog-to-digital converter, and a randomnessextractor, the method according to claim 10.